feat: Disable operator finalization

The operator finalizer cleans up all Kubernetes resources and invalidates statuses on operator
exit. Unfortunately, this feature seems to conflict with high-availability requirements, in that
operator restarts may cause clients' TURN sessions to break. This commit switches the finalizer off
by default. You can still enable it using the command line flag "--enable-finalizer=true".

internal/config/vars.go

@@ -51,4 +51,10 @@ var (
 	// (note that this breaks graceful backend shutdown, see
 	// https://github.com/l7mp/stunner/issues/138).
 	EndpointSliceAvailable = opdefault.DefaultEndpointSliceAvailable
+
+	// EnableFinalizer is a global config to switch operator finalization on. The finalizer
+	// will clean up all allocaeted Kubernetes resources (like dataplane deployments and
+	// LoadBalancer Services) on exit and invalidate Gateway API resource statuses. Use with
+	// caution: enabling this will caluse client connections to break on operator restart.
+	EnableFinalizer = opdefault.DefaultEnableFinalizer
 )

internal/operator/operator.go

@@ -69,7 +69,7 @@ func NewOperator(cfg OperatorConfig) *Operator {
 		updaterCh:    cfg.UpdaterCh,
 		configCh:     cfg.ConfigCh,
 		tracker:      config.NewProgressTracker(),
-		finalizer:    true,
+		finalizer:    config.EnableFinalizer,
 		gen:          0,
 		lastAckedGen: -1,
 		logger:       cfg.Logger,
@@ -193,7 +193,6 @@ func (o *Operator) eventLoop(ctx context.Context, cancel context.CancelFunc) {
 
 		case <-ctx.Done():
 			o.Terminate()
-
 			if cancel != nil {
 				cancel()
 			}

internal/renderer/service_util.go

@@ -381,7 +381,7 @@ func (r *Renderer) createLbService4Gateway(c *RenderContext, gw *gwapiv1.Gateway
 		svc.Spec.ExternalTrafficPolicy = corev1.ServiceExternalTrafficPolicyType("")
 	}
 
-	// nodeport
+	// NodePort
 	listenerNodeports := make(map[string]int)
 	if v, ok := annotations[opdefault.NodePortAnnotationKey]; ok {
 		if kvs, err := getServicePortsFromAnn(v); err != nil {

main.go

@@ -75,7 +75,7 @@ func init() {
 
 func main() {
 	var controllerName, dataplaneMode, metricsAddr, cdsAddr, throttleTimeout, probeAddr string
-	var enableLeaderElection, enableEDS, disableEndpontSliceController bool
+	var enableLeaderElection, enableEDS, disableEndpontSliceController, enableFinalizer bool
 
 	flag.StringVar(&controllerName, "controller-name", opdefault.DefaultControllerName,
 		"The conroller name to be used in the GatewayClass resource to bind it to this operator.")
@@ -93,6 +93,9 @@ func main() {
 	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
 		"Enable leader election for controller manager. "+
 			"Enabling this will ensure there is only one active controller manager.")
+	flag.BoolVar(&enableFinalizer, "enable-finalizer", opdefault.DefaultEnableFinalizer,
+		"Clean up allocated resources and invalidate resource statuses on operator exit.")
+
 	opts := zap.Options{
 		Development:     true,
 		DestWriter:      os.Stderr,
@@ -109,10 +112,13 @@ func main() {
 	buildInfo := buildinfo.BuildInfo{Version: version, CommitHash: commitHash, BuildDate: buildDate}
 	setupLog.Info(fmt.Sprintf("starting STUNner gateway operator %s", buildInfo.String()))
 
-	config.EndpointSliceAvailable = !disableEndpontSliceController // controller may override this
 	config.EnableEndpointDiscovery = enableEDS
-	setupLog.Info("endpoint discovery", "enabled", enableEDS,
-		"disable-endpointslice-controller", disableEndpontSliceController)
+	config.EndpointSliceAvailable = !disableEndpontSliceController // controller may override this
+	config.EnableFinalizer = enableFinalizer
+	setupLog.Info("operator flags",
+		"endpoint discovery", config.EnableEndpointDiscovery,
+		"endpointslice-controller", config.EndpointSliceAvailable,
+		"finalizer", config.EnableFinalizer)
 
 	if dataplaneMode == opdefault.DefaultDataplaneMode {
 		// dataplane mode not overrridden on the command line: use env var

pkg/config/defaults.go

@@ -30,6 +30,9 @@ const (
 	// DefaultEndpointSliceAvailable enables the EndpointSlice controller.
 	DefaultEndpointSliceAvailable = true
 
+	// DefaultEnableFinalizer controls whether to enable the operator finalizer.
+	DefaultEnableFinalizer = false
+
 	// OwnedByLabelKey is the name of the label that is used to mark resources (Services,
 	// ConfigMaps, and Deployments) dynamically created and maintained by the operator. Note
 	// that the Deployments and Services created by the operator will have both the AppLabelKey